Hacker News Reader

> There's really not a reason to ship or index logs.

Proper Information Security policy is one very good reason. If a box is compromised, you don't want the logs being tampered with.

You ship the logs to a central, dedicated server so that a clear audit trail can be established.

View on HN

Shipping software logs is just useless bureaucracy. Don't confuse it with shipping firewall/ssh/rdp logs which is an absolute must for telling how/when you were pwned. Hacker will just disable app/db logs, update their user as admin, dump the db and proceed with the cryptofuckery.

Eh? In my experience logs are some of the most valuable data produced by software. Debugging, experiments, software quality, auth trails, analytics, customer support, privacy, security, audit/compliance and abuse are all seriously useful applications for logs. Throwing them away is like dumping gold.

Yes, nobody said throw away application logs. That's dumb.

I imagine basically any form of compliance would require centralizing logs in some form

and for audit. Audit/Compliance is one of the worst yet valid reasons to introduce complexity, redundancy and all sorts of costs into projects. It's also why some people earn a living out of it purely.

Authentication, authorization and access logs typically. Generic application logs can often be treated differently.

Reply on news.ycombinator.com